Read the docs
TI-2026-74326 Aliases CVE-2026-77564GHSA-7cxh-94cf-mfp6

Talos Linux support bundles include unredacted registry credentials

Priority LOW 15CWE-312Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-312.

Summary

Talos Linux versions before 1.12.9 and from 1.13.0 before 1.13.3 are affected. The talosctl support command copies registry authentication fields and sensitive files into generated support bundles without redacting them, which is cleartext storage of sensitive information (CWE-312). An operator who shares a bundle with an unintended party can expose private registry credentials, with impact depending on the registry's network exposure and credential privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry's network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00131 2nd percentileScored 2026-11-08
Fix Fixed talos (siderolabs): 1.12.9, 1.13.3github.com/siderolabs/talos (Go): 1.14.0-alpha.0.0.20260513110206-76080416beee

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
siderolabstalosbefore 1.12.9; 1.13.0 to before 1.13.31.12.9, 1.13.3Patch availableCNA
—github.com/siderolabs/talos (Go)before 1.14.0-alpha.0.0.20260513110206-76080416beee1.14.0-alpha.0.0.20260513110206-76080416beeePatch availableGHSA-7cxh-94cf-mfp6
  • talos Vendorsiderolabs Affected before 1.12.9; 1.13.0 to before 1.13.3 Fixed in 1.12.9, 1.13.3 Patch available CNA
  • github.com/siderolabs/talos (Go) Vendor— Affected before 1.14.0-alpha.0.0.20260513110206-76080416beee Fixed in 1.14.0-alpha.0.0.20260513110206-76080416beee Patch available GHSA-7cxh-94cf-mfp6

Remediation

Upgrade Talos Linux to 1.12.9 or 1.13.3, which fix this issue. The Go module github.com/siderolabs/talos is fixed in 1.14.0-alpha.0.0.20260513110206-76080416beee. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA talos (siderolabs) Fixed in 1.12.9, 1.13.3
  • Fix · GHSA-7cxh-94cf-mfp6 github.com/siderolabs/talos (Go) Fixed in 1.14.0-alpha.0.0.20260513110206-76080416beee Advisory →

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-77564
  2. 2026-10-16 Alias added: GHSA-7cxh-94cf-mfp6
  3. 2026-10-16 Fix available: Go/github.com/talos-systems/[email protected] · GHSA-7cxh-94cf-mfp6
  4. 2026-10-16 CVSS score added · GHSA-7cxh-94cf-mfp6
  5. 2026-10-16 Weakness changed · GHSA-7cxh-94cf-mfp6
  6. 2026-10-16 11 new references · GHSA-7cxh-94cf-mfp6
  7. 2026-10-29 CISA SSVC decision points changed

References

Advisory 1

Other 10

  • TI-2025-37275 Omni is Vulnerable to DoS via Empty Create/Update Resource Requests CVSS 3.1HIGH 7.5
  • TI-2025-38119 Omni leaks information via the API CVSS 3.1HIGH 8.6
  • TI-2022-16526 Talos worker join token can be used to get elevated access level to the Talos API CVSS 3.1HIGH 8.8
  • TI-2026-33464 Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService CVSS 3.1HIGH 7.6
  • TI-2026-33459 Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token CVSS 3.1HIGH 7.0
  • TI-2026-33462 Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic CVSS 3.1LOW 2.7
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences